Azure API Management for Spring Boot Microservices

Azure API Management (APIM) sits in front of Spring Boot microservices as an API gateway, handling cross-cutting concerns — authentication, rate limiting, request transformation, caching, and API documentation — without putting that logic in each service.

What APIM handles

• Authentication: validate JWT tokens from Azure AD at the gateway before requests reach the backend — which means unauthorized requests are rejected at the edge without consuming backend resources
• Rate limiting: apply throttling policies per subscription key, per IP, or per user — rate-limit-by-key with a configurable window and call limit prevents one client from consuming all capacity
• Request/response transformation: add or strip headers, transform JSON, route requests based on content — set-header and set-body policies modify requests without changing backend code
• Caching: cache-lookup and cache-store policies cache GET responses at the gateway — which means repeated identical requests return cached responses without hitting the Spring Boot service

Policy expressions

• APIM policies are XML-based and run in four processing phases: inbound (before the backend), backend (controls the backend call), outbound (transforms the response), and on-error (handles exceptions)
• limits each subscription to 100 calls per minute without any rate limiting code in the Spring Boot service

Backend service registration

• Register Spring Boot services as APIM backends with their internal URL — ECS tasks behind an internal ALB, AKS services behind an internal load balancer, or App Service custom domains
• APIM calls the backend URL with backend policies applied; the Spring Boot service doesn't know APIM exists; it just receives HTTP requests as normal

Developer portal

• APIM auto-generates an API documentation portal from OpenAPI/Swagger definitions — import the Spring Boot service's /v3/api-docs endpoint; developers explore and test APIs from the portal